As IP-intensive businessess rely more and more on technology, they’re finding that technology can be a double-edged sword. Excel V. Dyquiangco speaks with lawyers about the cyber-attacks they’ve seen – and what’s still to come.  

Cybercriminals’ techniques for obtaining unauthorized access to sensitive data have evolved hand-in-hand with advances in technology. IP lawyers across the region say that it is critical to be updated on the top cybersecurity dangers of 2023 due to the growing reliance on technology in both personal and professional settings. 

“We view that the cybersecurity threats in IP are pretty much the same but they would be faster and on a larger scale,” says Pattaraphan Paiboon a partner at Baker McKenzie in Bangkok. “Some cybersecurity threats would target the IP of a company which relies on IP to run its operation. For example, cybersecurity threats could target trade secrets. Once the trade secrets are disclosed to the public, they would not be considered trade secrets. The company could lose its value, competitiveness and advantages.” 

She adds that as organizations are increasingly employing interconnectivity between their devices in their digital transformation, especially with the digitalization of valuable corporate information and the intellectual properties used in the business, vulnerabilities to cyber threats have subsequently increased. 

“While the methods used in these cyberthreats may not typically change, the speed, scale, and ease of attacks are increasing due to the advancement of computing capabilities, AI technologies, and the increase of vulnerabilities,” she says. “Moreover, these cyber-attacks, malware and other types of cyberattack software will be more difficult to detect. As a result, it is imperative for organizations to increase their cyber resiliency in the application of new technologies or transformation into digitized operations.” 

Risti Wulansari, a partner at K&K Advocates in Jakarta agrees. “Technological advancements and innovations in the global markets have benefitted intellectual property rights holders. However, every innovation has its drawbacks, and IPR infringement has become one of the major concerns as cyber technology has advanced. The ever-increasing and evolving cybercrimes include cyber stalking, fraud, cyberbullying, phishing, spamming and infringements of businesses’ IPR copyright, trademarks and trade secrets.”  

Ransomware and fraud 

Baker McKenzie lawyers in Bangkok highlight the following among some of these cybersecurity threats: 

Ransomware-as-a-service. As most organizations are looking to undergo digital transformation, the value of gains from each cyber-attack are increasing as well. As a result, bad actors are shifting from cyber-attacks as a hobby or for entertainment into a full-scale business.   

Multiple points of attacks. While cloud computing, software, and applications are being used substantially by organizations who have transferred to a cloud-based infrastructure, which may employ multiple services or endpoints, such organizations will be more vulnerable to a series of attacks on multiple channels. With these series of attacks, cybersecurity threats are more difficult to defend, especially for organizations who have not specifically laid down a solid security infrastructure. 

Social fraud/identity fraud. Phocharaphol Yingamphol, an associate at Baker McKenzie in Bangkok, says: “We are seeing an increasing trend of fraud on social media platforms, SMS messaging, and phone calls, especially spear phishing attacks targeting key executives or important personnel,” he says. “These fraudsters can monitor the activities or information of the victim from their publicly available information on social media or leaked personal data, then approach the victim posing as their acquaintance, friend or even government officials, and obtain monetary benefits, important information, or credentials from the victims. With the advancement of AI and deepfake technologies, these types of fraud may be more effective and harder to cope against for the victims.” 

 Vulnerabilities from open-source software. A large number of organizations opted to use open-source software in their digital transformation due to its flexibility, compatibility and lower cost. However, despite its benefits, open-source software is prone to vulnerabilities due to the possible lack of a dedicated support team, security patches, updates and adequate testing and quality assurance in their development. 

Cybersquatting and meta tagging 

In addition, Wulansari says that during the pandemic, remote working became the new standard and the new normal. “Working from home became the new way of doing business amid the fear of pandemic,” she says.  “However, while working from home allows businesses to continue operating as usual, this new way has also provided a conduit for online criminal activities. Consequently, new online threats, cybercrime have increased. Hackers and con artists tend to easily steal personal information using various methods, including traditional email phishing scams and advanced cross-site scripting (XSS).”  

“Now that we begin to see quite the end of the pandemic where working from home is no longer a mandatory option to undergo, we can’t help but admit that cybersecurity threats have evolved, and new innovation would be needed to overcome those.”  

Copyright infringement. This includes unauthorized use, making and distributing copies of the software, unauthorized sale and illegitimate copying from websites or blogs through illegal practices such as linking and framing. Linking directs a website user to another webpage by clicking on a text or image without leaving the current page. It endangers the website owner’s rights and interests, and the owner may lose money due to the number of users who visit the website. It may mislead users into believing that the two websites share the same domain and ownership. Another challenge is framing, which becomes a legal issue. The framer only provides users access to copyrighted content from a website to the browser the user uses. They cannot be held liable for copying, communicating, or distributing copyrighted content.  

Cybersquatting. Cybersquatting is a cybercrime that involves the imitation of a domain name in such a way that the resultant domain name can dupe the users of the famous one and profit from it. This is done by registering, selling, or trafficking a well-known domain name to cash in on its goodwill.   

Meta tagging. Meta tagging is a technique for increasing the number of users accessing a site by including a word in the keyword section so that the search engine picks up the word and directs users to the site, even if the site has nothing to do with that word. A website containing meta tags from other websites may result in trademark infringement, affecting their business.  

The use of artificial intelligence (AI) by hackers. AI is a two-edged sword; it improves security solutions while allowing hackers to circumvent them. Developing machine learning models was only possible if you had access to large budgets and resources, and models can now be created on personal laptop computers. Because of this, AI has progressed from major digital arms races to everyday attacks. While security teams use AI to detect suspicious behavior, hackers create bots that pass for human users and dynamically change the characteristics and behaviors of malware. 

Cybersecurity skill gap. There are constant concerns about the cybersecurity skills gap, and more cybersecurity experts are needed to fill all of the gaps. Modern threats are becoming more challenging to detect and stop. The security skills required to combat these threats go far beyond knowing how to use tools and configure encryption. These threats necessitate a broad understanding of various technologies, configurations, and environments. To obtain these skills, organizations must hire high-level experts or devote resources to training their employees.  

Threats on mobile devices. Nearly everyone owns a mobile device, even if people have yet to embrace innovative technologies fully. Smartphones, laptops, and tablets are all commonplace. These devices are frequently multipurpose and used for both professional and personal purposes, and users may connect devices to multiple networks. Because of their widespread use, mobile devices make an appealing target for hackers. Bring-your-own-device policies are standard, but they frequently lack internal control or management 

Protection against these new attacks 

Paiboon says that in Thailand, there are new developments in law and enforcement relating to cybersecurity. “The National Cyber Security Agency (NCSA) is looking to strictly enforce the Cybersecurity Act B.E. 2562 after it had worked on a cooperation basis with critical information infrastructure organizations,” she says. “Moreover, the NCSA is looking to amend the Cybersecurity Act, especially on the legal sanctions, to shift from voluntary compliance into sanctioned compliance for the cybersecurity standard framework.” 

In terms of private companies, Yingamphol says that IP can be crucial to protect companies against these new attacks, both in the prevention and response to the attacks.  

“Having in place a solid technological infrastructure, including the implementation of software or systems with cyber resiliency, can help prevent cyber-attacks,” he says. “Therefore, software that can withstand or counteract cyber-attacks is becoming increasingly valuable, and can be protected by IP rights, which fuels more innovation in this space. As a result, business operators with these IPs can leverage the increase in cyber-attacks and provide solutions as a service to organizations undergoing digital transformation. We have seen many companies implementing cyberthreat protection measures as a preventive approach, which is also in line with the current obligations under the Personal Data Protection Act, Cybersecurity Act and relevant IT security laws.” 

Additionally, digital forensics is an important measure in order to respond to a cyber-attack, learn from the incident and prevent one in the future. “Digital forensics is the measure of collecting and analyzing digital evidence related to cyber-attacks or any commission of crimes using computers, which is only possible with specialized tools and software,” he says. “Digital forensics specialists can collect data from compromised systems and analyze them in order to determine the pattern of attacks, isolate security breaches, and assess the impact of the cyber-attacks. These measures are important to recover from the attacks and to prevent further attacks.”  

He adds: “Companies can also rely on IP claims – patent, trade secrets, copyright – as a ground for prosecuting the violators in order to recover from any monetary loss or to prevent others from using the leaked IP.” 

Dhafin Collin Haryadi, an associate at K&K Advocates in Jakarta, says that every technological advancement exposes itself to threats. “On the one hand, cybersecurity must support and connect with other users, publish literary works and share knowledge,” he says. “At the same time, these personally identifiable, copyrighted, or patented data become vulnerable to cyber-attacks.”  

He adds: “It is best to have an effective intellectual property management strategy for all e-businesses in virtual worlds. Several national and international laws protect intellectual property from cyber threats. However, it is the moral responsibility of the owner of IPRs to take all necessary protective measures to prevent and reduce illegitimate virtual attacks.” 

- Excel V. Dyquiangco